Execution Evidence Protocol
The protocol defines Execution Receipts for attempts, outcomes, reversals, and reconciliations, with signed Receipt Commitments and append-only lifecycle links. Caller-defined private values remain outside every receipt.
The verifier evaluates record integrity and lifecycle consistency. Excluded assertions are authorization, external execution, factual truth, ordering, and completeness.
Protocol components
| Component | Function |
|---|---|
| Execution Receipt | Canonical evidence object for one attempt, outcome, reversal, or reconciliation. |
| Local journal | Persists lifecycle-linked records separately from caller-owned private values. |
| Receipt Commitment | Binds an Execution Receipt hash to its declared-signer signature and commitment profile. |
| Receipt Bundle | Packages lifecycle-linked Execution Receipts, Receipt Commitments, records, and references for independent offline verification. |
| MCP and HTTP ingress | Accepts evidence submissions without invoking or controlling an external action. |
Verifier result dimensions
Each dimension is evaluated independently from the supplied evidence and applicable verifier policy.
| Dimension | Allowed results |
|---|---|
| Evidence integrity | VALID · INVALID · INDETERMINATE |
| Attribution | DECLARED_SIGNER_ONLY · ENTERPRISE_VERIFIED · NOT_EVALUATED |
| Capture coverage | OBSERVED · NOT_CLAIMED |
| Independent readback | NOT_EVALUATED · NOT_APPLICABLE · REPORTED · AWAITING · CONFIRMED · CONTRADICTED · UNRESOLVED |
| Public availability | LOCAL_ONLY · REGISTERED · ANCHORED |
Execution Receipt creation
- Submit a declared attempt at the local ingress.
- Canonicalize and hash caller-defined private JSON locally.
- Create an Execution Receipt and signed Receipt Commitment.
- Append source-reported lifecycle observations.
- Retain private values and credentials outside the receipt.
Receipt Bundle verification
- Export a Receipt Bundle.
- Recompute Execution Receipt hashes and signatures offline.
- Validate lifecycle parents and source-event uniqueness.
- Evaluate every external trust claim separately.
Commitment construction
commitment = sha256(domain || canonicalize(privateValue))
Private caller-defined values are hashed at local ingress and are not included in the Execution Receipt or Receipt Bundle.
Verification scope
Deployment assurance depends on controls in the target environment. Source distribution does not establish target-environment assurance.
A valid Receipt Bundle establishes Execution Receipt integrity, signature validity, commitment bindings, and lifecycle consistency. Authorization, external ordering, factual truth, completeness, and action outcome require separate evidence.